Demonstration of Noriben for Black Hat US 2015 Arsenal

1. Your Personal, Portable, Malware Analysis Sandbox
Brian Baskin
@bbaskin
github.com/Rurik

2. Origin Story
Nori-Ben:
Seaweed Lunch Box
Simplest “box” to make
Cheap
Minimal ingredients

3. Noriben
 Simple Malware Analysis Sandbox
– Wrapper for Microsoft SysInternals Process Monitor (ProcMon)
– Build a Sandbox VM with just:
▪ Noriben.py
▪ Procmon.exe
– Optional:
▪ Extra Procmon binary filters
▪ YARA signature files
▪ VirusTotal API Key
▪ Add new filters to the script

4. Goals
 Quick malware analysis results
 Flexibility for open-ended runs (manually stopped analysis)
 Allow for user interaction
 Analysis of:
– GUI apps
– Command line args
– Malware requiring debugging (Z-flags, code/mem altering)
– Long sleeps (hours, days)

5. Focus
 Processes, File Activity, Registry Activity, Network Activity
 Log high level API calls while filtering out known noise
– Thumbnail creation
– Prefetch creation
– Explorer registry keys (MRUs)
– RecentDocs
– Malware analysis tools (CaptureBat, IDA, FakeNet)
– VMWare Tools
– Java updater …

6. ZeroAccess
Processes Created:
==================
[CreateProcess] Explorer.EXE:1432 > "%UserProfile%Desktophehda.exe" [Child PID: 2520]
[CreateProcess] hehda.exe:2520 > "%WinDir%system32cmd.exe" [Child PID: 3444]
File Activity:
==================
[CreateFile] hehda.exe:2520 > C:RECYCLERS-1-5-21-861567501-412668190-725345543-500$fab110457830839344b58457ddd1f357@
[MD5: 814c3536c2aab13763ac0beb7847a71f] [VT: Not Scanned]
[CreateFile] hehda.exe:2520 > C:RECYCLERS-1-5-21-861567501-412668190-725345543-500$fab110457830839344b58457ddd1f357n
[MD5: cfaddbb43ba973f8d15d7d2e50c63476] [YARA: ZeroAccess_Bin] [VT: 50/55]
[DeleteFile] cmd.exe:3444 > %UserProfile%Desktophehda.exe
Registry Activity:
==================
[CreateKey] hehda.exe:2520 > HKCUSoftwareClassesCLSID{fbeb8a05-beee-4442-804e-409d6c4515e9}InprocServer32
[SetValue] hehda.exe:2520 > HKCUSoftwareClassesCLSID{fbeb8a05-beee-4442-804e-
409d6c4515e9}InprocServer32ThreadingModel = Both
[SetValue] hehda.exe:2520 > HKCUSoftwareClassesCLSID{fbeb8a05-beee-4442-804e-409d6c4515e9}InprocServer32(Default) =
C:RECYCLERS-1-5-21-861567501-412668190-725345543-500$fab110457830839344b58457ddd1f357n.
Network Traffic:
==================
[UDP] hehda.exe:2520 > google-public-dns-a.google.com:53
[UDP] google-public-dns-a.google.com:53 > hehda.exe:2520
[HTTP] hehda.exe:2520 > 50.22.196.70-static.reverse.softlayer.com:80
[TCP] 50.22.196.70-static.reverse.softlayer.com:80 > hehda.exe:2520
[UDP] hehda.exe:2520 > 83.133.123.20:53

7. Upatre Campaign
Processes Created:
==================
[CreateProcess] python.exe:2752 > "malwaredocument.exe" [Child PID: 3048]
[CreateProcess] document.exe:3048 > "malwaredocument.exe" [Child PID: 3260]
[CreateProcess] document.exe:3260 > "%Temp%nlibzar.exe" [Child PID: 3632]
[CreateProcess] nlibzar.exe:3632 > "%Temp%nlibzar.exe" [Child PID: 4056]
File Activity:
==================
[CreateFile] document.exe:3260 > %Temp%bwtBBCB.tmp [MD5: fa32cacce112c18253a343c3fc41935a] [VT: Not Scanned]
[CreateFile] document.exe:3260 > %Temp%nlibzar.exe [MD5: 03721dc899125df9dba81f6d8d8997cf] [VT: 42/57]
[DeleteFile] nlibzar.exe:4056 > %UserProfile%DesktopMALWAREdocument.exe
[CreateFile] nlibzar.exe:4056 > %UserProfile%Local SettingsTemporary Internet
FilesContent.IE5CROVKFGZsuspendedpage[1].htm [MD5: 7acfe81f71e166364c90bfe156250da6] [VT: 0/56]
[DeleteFile] nlibzar.exe:4056 > %UserProfile%Local SettingsTemporary Internet
FilesContent.IE50V0T0HC5suspendedpage[1].htm
Network Traffic:
==================
[TCP] nlibzar.exe:4056 > 66.111.47.22:80
[TCP] 66.111.47.22:80 > nlibzar.exe:4056
[TCP] nlibzar.exe:4056 > 216.146.38.70:80
[TCP] 216.146.38.70:80 > nlibzar.exe:4056
[TCP] nlibzar.exe:4056 > 8.5.1.58:80
[TCP] 8.5.1.58:80 > nlibzar.exe:4056

8. FakeAV (Track Activity Per Button Clicked)

9. FakeAV (Track Activity Per Button Clicked)
Processes Created:
==================
[CreateProcess] python.exe:2376 > "C:malwareFakeAV.exe“ [Child PID: 1556]
[CreateProcess] FakeAV.exe:1556 > "%WinDir%system32cmd.exe /c taskkill /f /pid 1556 & ping -n 3
127.1 & del /f /q C:malwareFakeAV.exe & start C:DOCUME~1ADMINI~1APPLIC~1DPNCXX~1.EXE -f“
[Child PID: 1164]
[CreateProcess] cmd.exe:1164 > "taskkill /f /pid 1556 “ [Child PID: 1344]
[CreateProcess] cmd.exe:1164 > "ping -n 3 127.1 " [Child PID: 2748]
[CreateProcess] cmd.exe:1164 > "C:DOCUME~1ADMINI~1LOCALS~1APPLIC~1DPNCXX~1.EXE -f“ [Child
PID: 776]
File Activity:
==================
[CreateFile] FakeAV.exe:1556 > %AppData%dpncxxavk.exe [MD5: 8915c6a007fb93b29709be2f428e5cae]
[DeleteFile] cmd.exe:1164 > C:MalwareFakeAV.exe
[CreateFile] dpncxxavk.exe:776 > %AppData%GDIPFONTCACHEV1.DAT [File no longer exists]
Registry Activity:
==================
[RegDeleteValue] FakeAV.exe:1556 > HKCUSoftwareMicrosoftWindowsCurrentVersionRunOnceFakeAV

10. Command line (e.g. HTran)
Processes Created:
==================
[CreateProcess] cmd.exe:3024 > "htran“ [Child PID: 3924]
[CreateProcess] cmd.exe:3024 > "htran -h“ [Child PID: 3848]
[CreateProcess] cmd.exe:3024 > "htran -install“ [Child PID: 3688]
[CreateProcess] cmd.exe:3024 > "htran -start“ [Child PID: 4072]
[CreateProcess] services.exe:720 > "C:Malwarehtran.exe -run“ [Child PID: 268]
Registry Activity:
==================
[RegSetValue] services.exe:720 > HKLMSystemCurrentControlSetServicesHTranType = 272
[RegSetValue] services.exe:720 > HKLMSystemCurrentControlSetServicesHTranStart = 2
[RegSetValue] services.exe:720 > HKLMSystemCurrentControlSetServicesHTranImagePath =
C:Malwarehtran.exe -run
[RegSetValue] services.exe:720 > HKLMSystemCurrentControlSetServicesHTranDisplayName = Proxy Service
[RegSetValue] services.exe:720 > HKLMSystemCurrentControlSetServicesHTranObjectName = LocalSystem
[RegSetValue] htran.exe:3688 > HKLMSystemCurrentControlSetServicesHTranDescription = HUC Socks5 Proxy
Service.
[RegSetValue] htran.exe:3688 > HKLMSystemCurrentControlSetServicesHTranDatastyk = 0
[RegSetValue] htran.exe:3688 > HKLMSystemCurrentControlSetServicesHTranDatasbpk = 8009
[RegSetValue] htran.exe:3688 > HKLMSystemCurrentControlSetServicesHTranDataschk = 127.0.0.1
[RegSetValue] htran.exe:3688 > HKLMSystemCurrentControlSetServicesHTranDatascpk = 80
[RegSetValue] htran.exe:3688 > HKLMSystemCurrentControlSetServicesHTranDataslpk = 8009
Track activity
per PID

11. Monitor Through Debugger
 Or modify memory during exec (e.g.
inject decrypted data into memory)
 Noriben will just show process as
“OllyDbg.exe” or “Immunity.exe”
Set BP at JNZ
Toggle Z-Flag
…
Profit!

12. Noriben Output
• Designed to be simple:
• Show precise IOCs without much noise.
• Easy to Copy/Paste into reports, signatures, alerts, code
• Can be an automated sandbox, works best alongside
capable analyst
• And Notepad++: double-click PID to highlight all
Processes Created:
==================
[CreateProcess] document.exe:3048 > "malwaredocument.exe“ [Child PID: 3260]
[CreateProcess] document.exe:3260 > "%Temp%nlibzar.exe“ [Child PID: 3632]
File Activity:
==================
[CreateFile] document.exe:3260 > %TEMP%bwtBBCB.tmp [MD5: fa32cacce112c18253a343c3fc41935a] [VT: Not Scanned]
[CreateFile] document.exe:3260 > %TEMP%nlibzar.exe [MD5: 03721dc899125df9dba81f6d8d8997cf] [VT: 42/57]
Network Traffic:
==================
[TCP] nlibzar.exe:4056 > 66.111.47.22:80
[TCP] 66.111.47.22:80 > nlibzar.exe:4056

13. Options
 Pre-filter content using ProcMon Configuration (PMC)
filters
– Reduces logs from 500 MB to < 50 MB
 Import file MD5 white lists
 Generalize folder paths:
– “C:UsersMalwareAppDataRoaming” > %AppData%
– “C:UsersMalwareAppDataLocalTemp” > %Temp%

14. Whitelist Filters
 Simple to write!
 RegEx
 Just add to top of Noriben.py
cmd_whitelist = [r'%SystemRoot%system32wbemwmiprvse.exe',
r'%SystemRoot%system32wscntfy.exe', ...
file_whitelist = [r'procmon.exe',
r'Thumbs.db$',
r'%SystemRoot%system32wbemLogs*', ...
reg_whitelist = [r'CaptureProcessMonitor',
r'HKCUSoftwareMicrosoft.*Window_Placement',
r'HKCUSoftwareMicrosoftInternet ExplorerTypedURLs',
r'SoftwareMicrosoftWindowsCurrentVersionExplorerFileExts.doc',
r'SoftwareMicrosoftWindowsCurrentVersionExplorerRecentDocs', ...

15. VirusTotal
 Query MD5 file hashes from VirusTotal
– Requires Python-Requests library
– API key in file “virustotal.api” (unless otherwise specified)
– Transmits MD5 hashes ONLY (for now)
– Raw results stored if debug (-d) is enabled:
[*] Writing 2 VirusTotal results to Noriben_10_Jul_15__19_24_48_028000.vt.json
[{"scan_id": "8e17d44a23c27f37be5eec94addd979560c0c0aec613750248c2306acacf527e-
1428647243", "sha1": "f0d23da00b382b33b343de8526eaae62df9b3049", "resource":
"03721dc899125df9dba81f6d8d8997cf", "response_code": 1, "scan_date": "2015-04-10
06:27:23", "permalink":
"https://www.virustotal.com/file/8e17d44a23c27f37be5eec94addd979560c0c0aec613750248c2306
acacf527e/analysis/1428647243/", "verbose_msg": "Scan finished, information embedded",
"sha256": "8e17d44a23c27f37be5eec94addd979560c0c0aec613750248c2306acacf527e",
"positives": 42, "total": 57, "md5": "03721dc899125df9dba81f6d8d8997cf", "scans":
{"Bkav": ...

16. YARA
 Intakes a folder of YARA signatures
 Requires yara lib (from source, not pip)
 Soft fails on broken rules 
 Scans against every created, present file

17. Timeline Output (CSV)
 For automated sandbox analysis
 For knowing the timing/order of events
3:24:51,Process,CreateProcess,python.exe,2752,malwaredocument.exe,3048
3:24:51,Process,CreateProcess,document.exe,3048,malwaredocument.exe,3260
3:24:51,File,CreateFile,document.exe,3260,%UserProfile%Local
SettingsTempbwtBBCB.tmp,fa32cacce112c18253a343c3fc41935a,,[VT: Not Scanned]
3:24:51,File,CreateFile,document.exe,3260,%UserProfile%Local
SettingsTempnlibzar.exe,03721dc899125df9dba81f6d8d8997cf,,[VT: 42/57]
3:24:51,Process,CreateProcess,document.exe,3260,%Temp%nlibzar.exe,3632
3:24:52,Process,CreateProcess,nlibzar.exe,3632,%Temp%nlibzar.exe,4056
3:24:52,File,DeleteFile,nlibzar.exe,4056,%UserProfile%DesktopMALWAREdocument.exe
3:24:52,File,CreateFile,nlibzar.exe,4056,%UserProfile%Cookiesindex.dat,ad8004807700f1d8d5ab6fa8c2935ef6,,
[VT: Not Scanned]
3:25:07,Network,TCP Send,nlibzar.exe,4056,66.111.47.22:80
3:25:07,Network,TCP Receive,nlibzar.exe,4056
3:25:07,File,CreateFile,nlibzar.exe,4056,%UserProfile%Local SettingsTemporary Internet
FilesContent.IE50V0T0HC5suspendedpage[1].htm,7acfe81f71e166364c90bfe156250da6,,[VT: 0/56]
3:25:15,Network,TCP Send,nlibzar.exe,4056,216.146.38.70:80
3:25:15,Network,TCP Receive,nlibzar.exe,4056
3:25:17,Network,TCP Send,nlibzar.exe,4056,8.5.1.58:80
3:25:17,Network,TCP Receive,nlibzar.exe,4056